Check for valid PE file

[Tedd]

Isn't the MZ stub optional? I mean, it's not strictly necessary and is only there in case you try to run it from DOS.
Anyway, point being that this code requires it and I don't think the PE does.

[hutch--]

No, A member of the MZ header is required to locate the PE header. The PE specification includes the MZ 16 bit real mode header.

[Jibz]

Yes, the MZ header is required .. at least enough of it that the Windows PE loader interprets it as such -- i.e. if the MZ signature and the e_lfanew members are correct, the PE file should work. Of course it's best to use a valid stub executable to be safe :U.

[billy]

Check out the code in the MS .NET beta 2005 for the crt stub that gets called upon loading (it calls a C/C++ application's main() function). It contains the code to scan a PE, and will even determine if it has .NET managed code in it. FYI, 2005 beta is a free download, but you must agree to send feedback.

[hutch--]

The 2005 beta does not allow distribution of code developed using it. The licence is specific to testing and giving fedback to Microsoft.

[billy]

The 2005 beta does not allow distribution of code developed using it. The licence is specific to testing and giving fedback to Microsoft.

I didn't mean to distribute the code, but it can be studied to see how the PE header is layed out.

[Tedd]

No, A member of the MZ header is required to locate the PE header. The PE specification includes the MZ 16 bit real mode header.

Yes, but if the stub isn't there, then the PE header would start at offset 0 :bg (...usually)

[hutch--]

 :bg

Yes, but if the stub isn't there, then the PE header would start at offset 0  (...usually)

This would be fine if you wrote your own EXE file loader but Microsoft PE specs require an MZ header, properly a dos stub and without it, it ain't a PE file. Try it through any version windows loader and it will go bang.

[Tedd]

Fairy nuff :8)

[chetnik]

PE executable should start with MZ header, and that's what it sais in PE specification. I haven't seen, yet, PEexecutable without MZ at the begining.

Best regards =)

p.s.
I don't like MapViewOfFile =))) I like old Unix file handling =))))))))))

[Polizei]

Well donkey, you could install a SEH frame when checking the file for a VALID additional header (LE/PE/etc.) i had some files on my PC that don't have a GOOD DOS-header and the [e_lfanew] member was junk :( so that causes a "General Protection Fault" (Win98) By the way, I use the same code when openning PE files in my PElib :>

[chetnik]

Yap I do the same thing in my file finder/check valid PE code, install SEH, and if progy fails to read from memory where lefnew is pointing(bad mz header) it just unmaps file, closes handles and continues with search  :dazzled: :dazzled:

Best regards